CertifiPic: An Image Authenticity Lab, Not a Magic Detector

Published 2026-08-24 by Faraz Rahimi

Drop in a photo and get JSON plus PNG overlays. CertifiPic is a forensic pipeline: provenance first, then ELA, noise, copy-move, and an AI-generation score.

CertifiPic: An Image Authenticity Lab, Not a Magic Detector

Tags: TypeScript, Forensics, C2PA, Computer Vision, API

CertifiPic is an image authenticity engine with a lab UI, a TypeScript SDK, and an HTTP API. You drop in a photo. It comes back with JSON plus colored PNG overlays you can plug into another app.

It is not a single fake-or-real neural net. Those models are confident and wrong in the same sentence. I wanted something I could explain to a person staring at an invoice.

What it is for

    People ask three different questions and pretend they are one:
  • Was this file signed or exported with provenance?
  • Was this raster edited after capture?
  • Does this look generated?

CertifiPic answers them separately, then fuses the signals into a risk score, marked regions, and an AI-generation score from 0 to 100.

Error-level analysis highlighting a pasted region on a document.

Documents are not selfies. Paper-baseline error-level analysis ignores letter strokes and keeps compact compression blobs, so a pasted dollar amount can light up without painting the whole page red.

How it technically works

The pipeline is ordered on purpose.

1. Provenance. Read C2PA, IPTC, XMP, and EXIF first. If a credential says the file was exported from a camera or an editor, that is evidence. Missing provenance is not guilt. It is a missing field.
2. Classify the raster. Photograph, document, or graphic. The later maps change depending on that label.
3. Cheap forensic maps. Error-level analysis, noise residual, edge inconsistency, and copy-move. Photos also get Fourier and sensor-grain screens.
4. Fusion. Maps become regions. Regions plus provenance become a risk score. A separate head estimates AI generation without overwriting the edit maps.

The lab is a Vite + React UI. The engine is TypeScript, with Python helpers where EXIF and C2PA tooling is stronger. The HTTP API is a Hono server on Node: POST an image, get JSON plus overlay PNGs. Canvas draws the colored masks so a host app does not have to invent a renderer.

Lab UI with a forensic overlay and structured JSON output.

Call it from another product when you need a second opinion on a screenshot, a listing photo, or a scanned form. Do not use it as a courtroom. Use it as a lab that shows its work.

Original post: https://farazrahimi.com/posts/certifipic-image-authenticity-lab